4 ms·

The aim of EV certificates is to reduce such risks and highlight to the user the legitimacy of such websites. HTTPS alone only provides encryption. Google does

The aim of EV certificates is to reduce such risks and highlight to the user the legitimacy of such websites. HTTPS alone only provides encryption. Google doesn't use EV anywhere but I feel it should on login pages especially given it is a high phishing target.

sowpati 10y ago
I'm not an expert, but as I understand, they don't actually use password fields on phishing pages. Instead they use normal text fields and fake password dots. So I'm not sure if they can be identified as login pages. ETA: another parent comment talks about the same thing.
- andygambles 10y ago
  In general they should use EV site wide rather than just login pages just to help confirm it is the correct legitimate website.
bad_user 10y ago
EV certificates don't work. You're relying on the user to spot a change in the address bar, which is no different than relying on the user to notice that the domain is not "gmail.com". HTTPS is meant for preventing MITM attacks, but it isn't meant to validate the identity of the entity you're speaking to; even though some people try doing that, it's just a game of pretend.
- andygambles 10y ago
  It is a much more visible change rather than a URL that could be spoofed or malformed.
- MrManatee 10y ago
  I totally agree that EV certificates don't work. I know the difference between EV and DV, but I'm glad I don't have to rely on that knowledge very much. I don't trust myself that I would notice if an EV site would suddenly have a slightly different looking DV-style lock icon. I don't even trust myself to remember which sites use EV in the first place. As many other commenters here, I mostly rely on password autocompletion. If autocompletion doesn't recognize the site, then I'm extra careful. The point is that this is rare enough so that it is actually feasible for me to be careful on those occasions.

sowpati 10y ago

I'm not an expert, but as I understand, they don't actually use password fields on phishing pages. Instead they use normal text fields and fake password dots. So I'm not sure if they can be identified as login pages. ETA: another parent comment talks about the same thing.

andygambles 10y ago
In general they should use EV site wide rather than just login pages just to help confirm it is the correct legitimate website.

bad_user 10y ago

EV certificates don't work. You're relying on the user to spot a change in the address bar, which is no different than relying on the user to notice that the domain is not "gmail.com". HTTPS is meant for preventing MITM attacks, but it isn't meant to validate the identity of the entity you're speaking to; even though some people try doing that, it's just a game of pretend.

andygambles 10y ago
It is a much more visible change rather than a URL that could be spoofed or malformed.
MrManatee 10y ago
I totally agree that EV certificates don't work. I know the difference between EV and DV, but I'm glad I don't have to rely on that knowledge very much. I don't trust myself that I would notice if an EV site would suddenly have a slightly different looking DV-style lock icon. I don't even trust myself to remember which sites use EV in the first place. As many other commenters here, I mostly rely on password autocompletion. If autocompletion doesn't recognize the site, then I'm extra careful. The point is that this is rare enough so that it is actually feasible for me to be careful on those occasions.